Hosting server cpu is drowned with connections to/from Cloudflare

We have configured Cloudflare CDN to cache static resources from our website and our website seems to be creating lots of connections to Cloudflare IPs each 5 to 10 seconds. The end result is that we are completely overpassing the CPU limits of our current hosting.

Can anyone share if you’ve had a similar problem and ways to tackle it?

Thanks,

That sounds like normal use for a site using Cloudflare. What’s showing up in your server logs?

I’m surprised you’re seeing such negative effects by those connections being made.

Do you have any logs you can share?

Yes, the following is a list of all outgoing connections made from our server during 9-10-2019 at 00hrs. As you can see, there’s approximately 100 connections made from our server to IPs owned by Cloudflare (I’m wondering if this is the normal CDN behaviour or if there could be any misconfiguration on our side):

[2019 Oct 29 00:00:08] [11787859.219635] TCP:54864 => 104.27.169.52:80
[2019 Oct 29 00:01:03] [11787914.819425] TCP:55192 => 104.27.169.52:80
[2019 Oct 29 00:01:21] [11787932.551172] TCP:55306 => 104.27.169.52:80
[2019 Oct 29 00:02:36] [11788006.970860] TCP:38216 => 104.27.168.52:80
[2019 Oct 29 00:03:50] [11788081.502132] TCP:57092 => 104.27.169.52:80
[2019 Oct 29 00:04:05] [11788096.602904] TCP:57124 => 104.27.169.52:80
[2019 Oct 29 00:04:56] [11788147.858363] TCP:37566 => 104.27.168.52:443
[2019 Oct 29 00:05:10] [11788160.959668] TCP:37732 => 104.27.168.52:443
[2019 Oct 29 00:06:18] [11788229.265233] TCP:40080 => 104.27.168.52:80
[2019 Oct 29 00:06:52] [11788263.875075] TCP:40446 => 104.27.168.52:80
[2019 Oct 29 00:07:36] [11788307.548032] TCP:40754 => 104.27.168.52:80
[2019 Oct 29 00:10:08] [11788459.166964] TCP:41790 => 104.27.168.52:80
[2019 Oct 29 00:11:24] [11788534.989922] TCP:42358 => 104.27.168.52:80
[2019 Oct 29 00:11:47] [11788558.456326] TCP:60632 => 104.27.169.52:80
[2019 Oct 29 00:12:00] [11788571.650314] TCP:58590 => 104.27.169.52:443
[2019 Oct 29 00:12:18] [11788588.979137] TCP:42866 => 104.27.168.52:80
[2019 Oct 29 00:12:28] [11788599.667243] TCP:58798 => 104.27.169.52:443
[2019 Oct 29 00:12:43] [11788614.555833] TCP:58936 => 104.27.169.52:443
[2019 Oct 29 00:13:52] [11788683.281282] TCP:43472 => 104.27.168.52:80
[2019 Oct 29 00:14:09] [11788700.856734] TCP:43582 => 104.27.168.52:80
[2019 Oct 29 00:14:14] [11788705.692558] TCP:59498 => 104.27.169.52:443
[2019 Oct 29 00:16:19] [11788830.735485] TCP:34424 => 104.27.169.52:80
[2019 Oct 29 00:16:20] [11788831.077087] TCP:44638 => 104.27.168.52:80
[2019 Oct 29 00:17:34] [11788905.412790] TCP:45312 => 104.27.168.52:80
[2019 Oct 29 00:17:49] [11788920.538721] TCP:43584 => 104.27.168.52:443
[2019 Oct 29 00:18:43] [11788974.143973] TCP:35550 => 104.27.169.52:80
[2019 Oct 29 00:18:53] [11788984.549739] TCP:33450 => 104.27.169.52:443
[2019 Oct 29 00:19:44] [11789035.153115] TCP:33766 => 104.27.169.52:443
[2019 Oct 29 00:20:01] [11789052.797379] TCP:46302 => 104.27.168.52:80
[2019 Oct 29 00:20:28] [11789079.104828] TCP:46508 => 104.27.168.52:80
[2019 Oct 29 00:21:03] [11789113.976956] TCP:46702 => 104.27.168.52:80
[2019 Oct 29 00:21:09] [11789120.512655] TCP:50098 => 157.240.20.15:443
[2019 Oct 29 00:21:12] [11789123.303257] TCP:46826 => 104.27.168.52:80
[2019 Oct 29 00:21:21] [11789132.303404] TCP:34502 => 104.27.169.52:443
[2019 Oct 29 00:22:17] [11789188.401326] TCP:47414 => 104.27.168.52:80
[2019 Oct 29 00:22:19] [11789190.358369] TCP:50700 => 157.240.20.15:443
[2019 Oct 29 00:22:34] [11789205.212722] TCP:47602 => 104.27.168.52:80
[2019 Oct 29 00:23:32] [11789263.673302] TCP:37704 => 104.27.169.52:80
[2019 Oct 29 00:23:47] [11789278.769932] TCP:48074 => 104.27.168.52:80
[2019 Oct 29 00:24:28] [11789319.040732] TCP:46422 => 104.27.168.52:443
[2019 Oct 29 00:24:29] [11789320.237913] TCP:51616 => 157.240.20.15:443
[2019 Oct 29 00:25:03] [11789354.490897] TCP:48594 => 104.27.168.52:80
[2019 Oct 29 00:26:11] [11789422.454581] TCP:38972 => 104.27.169.52:80
[2019 Oct 29 00:26:22] [11789433.580918] TCP:47458 => 104.27.168.52:443
[2019 Oct 29 00:27:00] [11789471.422793] TCP:47958 => 104.27.168.52:443
[2019 Oct 29 00:27:32] [11789503.600383] TCP:39900 => 104.27.169.52:80
[2019 Oct 29 00:27:53] [11789523.981729] TCP:50276 => 104.27.168.52:80
[2019 Oct 29 00:28:05] [11789536.802398] TCP:48454 => 104.27.168.52:443
[2019 Oct 29 00:28:15] [11789546.511838] TCP:40198 => 104.27.169.52:80
[2019 Oct 29 00:28:26] [11789557.651362] TCP:50536 => 104.27.168.52:80
[2019 Oct 29 00:28:37] [11789568.640816] TCP:48768 => 104.27.168.52:443
[2019 Oct 29 00:28:51] [11789582.210221] TCP:48880 => 104.27.168.52:443
[2019 Oct 29 00:30:00] [11789651.833424] TCP:41130 => 104.27.169.52:80
[2019 Oct 29 00:31:17] [11789728.165446] TCP:41702 => 104.27.169.52:80
[2019 Oct 29 00:32:30] [11789801.216792] TCP:52746 => 104.27.168.52:80
[2019 Oct 29 00:33:22] [11789853.814616] TCP:53122 => 104.27.168.52:80
[2019 Oct 29 00:33:50] [11789881.056307] TCP:43152 => 104.27.169.52:80
[2019 Oct 29 00:34:12] [11789903.452932] TCP:51656 => 104.27.168.52:443
[2019 Oct 29 00:35:04] [11789955.883055] TCP:43792 => 104.27.169.52:80
[2019 Oct 29 00:35:44] [11789995.671511] TCP:44220 => 104.27.169.52:80
[2019 Oct 29 00:36:19] [11790030.664272] TCP:44510 => 104.27.169.52:80
[2019 Oct 29 00:37:14] [11790085.226847] TCP:55376 => 104.27.168.52:80
[2019 Oct 29 00:37:33] [11790104.841545] TCP:45308 => 104.27.169.52:80
[2019 Oct 29 00:37:47] [11790118.215369] TCP:55648 => 104.27.168.52:80
[2019 Oct 29 00:38:39] [11790170.818895] TCP:43728 => 104.27.169.52:443
[2019 Oct 29 00:38:53] [11790184.290528] TCP:54382 => 104.27.168.52:443
[2019 Oct 29 00:40:04] [11790255.029168] TCP:56940 => 104.27.168.52:80
[2019 Oct 29 00:41:32] [11790343.173313] TCP:55848 => 104.27.168.52:443
[2019 Oct 29 00:42:27] [11790398.167610] TCP:58302 => 104.27.168.52:80
[2019 Oct 29 00:42:44] [11790415.904019] TCP:58406 => 104.27.168.52:80
[2019 Oct 29 00:43:42] [11790473.517066] TCP:48752 => 104.27.169.52:80
[2019 Oct 29 00:43:47] [11790478.110401] TCP:46794 => 146.66.99.75:443
[2019 Oct 29 00:43:58] [11790489.682131] TCP:48872 => 104.27.169.52:80
[2019 Oct 29 00:44:09] [11790500.482392] TCP:57302 => 104.27.168.52:443
[2019 Oct 29 00:44:22] [11790513.429562] TCP:57420 => 104.27.168.52:443
[2019 Oct 29 00:44:53] [11790544.403246] TCP:49390 => 104.27.169.52:80
[2019 Oct 29 00:45:12] [11790563.958995] TCP:49574 => 104.27.169.52:80
[2019 Oct 29 00:45:27] [11790578.630515] TCP:57994 => 104.27.168.52:443
[2019 Oct 29 00:46:26] [11790637.944843] TCP:58366 => 104.27.168.52:443
[2019 Oct 29 00:46:57] [11790668.467729] TCP:60606 => 104.27.168.52:80
[2019 Oct 29 00:47:41] [11790712.695791] TCP:60902 => 104.27.168.52:80
[2019 Oct 29 00:48:47] [11790778.058205] TCP:59510 => 104.27.168.52:443
[2019 Oct 29 00:49:01] [11790792.139332] TCP:49148 => 104.27.169.52:443
[2019 Oct 29 00:49:11] [11790802.759857] TCP:49192 => 104.27.169.52:443
[2019 Oct 29 00:50:11] [11790862.145522] TCP:51804 => 104.27.169.52:80
[2019 Oct 29 00:51:13] [11790924.356589] TCP:34182 => 104.27.168.52:80
[2019 Oct 29 00:51:33] [11790944.910821] TCP:52340 => 104.27.169.52:80
[2019 Oct 29 00:52:49] [11791020.727403] TCP:52958 => 104.27.169.52:80
[2019 Oct 29 00:52:59] [11791030.817531] TCP:33130 => 104.27.168.52:443
[2019 Oct 29 00:53:32] [11791063.725886] TCP:35332 => 104.27.168.52:80
[2019 Oct 29 00:53:47] [11791078.872456] TCP:53416 => 104.27.169.52:80
[2019 Oct 29 00:54:03] [11791094.594804] TCP:35542 => 104.27.168.52:80
[2019 Oct 29 00:56:33] [11791244.015746] TCP:54724 => 104.27.169.52:80
[2019 Oct 29 00:57:47] [11791318.689446] TCP:55286 => 104.27.169.52:80
[2019 Oct 29 00:58:25] [11791356.405638] TCP:37510 => 104.27.168.52:80
[2019 Oct 29 00:59:02] [11791393.628630] TCP:55868 => 104.27.169.52:80

Thanks in advance for your kind support :wink:

That traffic looks like something on your server connecting to a website. Would those happen to be the IP addresses Cloudflare has assigned for your website? This tool shows what hostnames are on that IP address:

https://www.yougetsignal.com/tools/web-sites-on-web-server/

Hi again, yes nearly all IPs on that list belong to Cloudflare.

My guess, misused web requests for cron :slight_smile:

No Cron jobs in our web application/server. It’s true that it’s a Wordpress portal and we do have WP Fastest Cache installed and configured with Cloudflare. But even without this plugin installed we still see that outbound traffic so my guess would be to say it’s not that plugin generating the traffic. Any other idea?

Whats your domain?

1 Like

For whatever webserver you use, try to ensure visitors IP


Restoring original visitor IPs: Logging visitor IP addresses with …

Hi Sandro, somehow I can’t pm you with the domain name (Wouldn’t want that info exposed publicly in the forum). Why is this information relevant? / any chance I can pm you the domain any other way?

You can run a test with your domain at sitemeer.com and post here the time when you ran it.

Yes, it is obvious these IP addresses belong to Cloudflare but - as @sdayman wrote - the question is whether these are your IP addresses are yours or not. In any case, however, this is most likely not Cloudflare related but simply an issue on your own server.

1 Like